Every route needs one of:
- the board’s session cookie, which a browser gets by signing in with a passkey;
- an agent token:
Authorization: Bearer <token>, made on Connect agents (/agents).
Two exceptions need neither: /api/health on this machine, and the sign-in calls (/api/auth/* of
setup, login and enrolment). Without a session or a valid token, a call gets 401.
Bodies are JSON in and out. actor in an answer is the account’s name or the agent token’s.
A backslash in a JSON string is written \\, so a Windows path is "C:\\code\\repo". Some shells
collapse \\ to \ before sending: where that leaves a bad escape the board refuses the body (400), but
where it leaves a valid one (\t, \n) the string silently changes. \u005c survives them.
The routes mirror the MCP tools, and the MCP server itself is /api/mcp.
Writes marked “the human’s” answer 403 to an agent.
You and sign-in
| Method |
Path |
What it does |
| GET |
/api/me |
Who you are: name, whether an agent, role, parent. |
| GET |
/api/actors |
Every name the board has seen sign in, with kind and role. |
| POST |
/api/auth/setup/options · /api/auth/setup/verify |
First boot: the account and its first passkey, from this machine. |
| POST |
/api/auth/login/options · /api/auth/login/verify · /api/auth/logout |
Sign in with a passkey · end this session. |
| POST |
/api/auth/enrol-links |
A one-time link to add another device (15 minutes); the human’s. |
| POST |
/api/auth/enrol/options · /api/auth/enrol/verify |
That device’s passkey. |
| GET/DELETE |
/api/auth/passkeys · /api/auth/passkeys/:id |
The passkeys · revoke one (not this machine’s last); the human’s. |
| GET/DELETE |
/api/auth/sessions · /api/auth/sessions/:id |
The live sessions · end one; the human’s. |
| POST |
/api/agent-tokens |
A new agent token, shown in this answer only; the human’s. |
| GET/DELETE |
/api/agent-tokens · /api/agent-tokens/:id |
The tokens not revoked · revoke one; the human’s. |
| PATCH |
/api/agent-tokens/:id |
Set a token’s role, orchestrator or worker; the human’s. |
Board setup
| Method |
Path |
What it does |
| GET · POST |
/api/host-tools · /api/host-tools/check |
The last check of git, gh, claude, node, pnpm · check again. |
| GET |
/api/agent-setup · /api/agent-setup/skill?client=claude|codex|opencode |
The board’s URL for Connect agents · the board skill. |
| GET |
/api/agent-setup/review-skills · /api/agent-setup/review-skills?list |
The review skills as a tar for ~/.claude · the paths it holds. |
| GET |
/api/agent-setup/review-skills/status |
Whether the installed review skills match what the board serves. |
| GET |
/api/agent-setup/review-skills/diff?path=&repoId= |
One of those files, installed against served. |
| GET/PATCH |
/api/settings |
Board-wide preferences, such as the preview limit. |
Projects, repositories and stages
| Method |
Path |
What it does |
| GET/POST |
/api/projects · GET/PATCH/DELETE /api/projects/:id |
Projects with their repositories, stages, agents, tags, layout and stall time. |
| PUT |
/api/projects/:id/instructions |
Replace a project’s instructions; the human and an orchestrator. |
| GET |
/api/projects/:id/instructions/changes · /api/instructions/changes/:id |
Every change of the instructions · one. |
| POST |
/api/instructions/changes/:id/review · /api/instructions/changes/:id/revert |
Mark a change reviewed · put the text back; the human’s. |
| GET/POST |
/api/projects/:id/agents · PATCH/DELETE /api/agents/:id |
The project’s agents; writes are the human’s. |
| POST |
/api/projects/:id/agents/defaults |
Add the default agents the project lacks; the human’s. |
| GET/POST |
/api/projects/:id/stages · PATCH/DELETE /api/projects/:id/stages/:stageId |
The board’s columns; writes are the human’s. |
| PUT |
/api/projects/:id/stages/order |
Reorder the stages; the human’s. |
| GET/POST |
/api/repos · PATCH/DELETE /api/repos/:id · GET /api/repos/:id/branches |
Repositories; writes are the human’s (an orchestrator may move one). |
Tickets
| Method |
Path |
What it does |
| GET/POST |
/api/projects/:id/tickets · GET/PATCH/DELETE /api/tickets/:id |
Tickets and lanes, with tasks, repositories, needs, resume note and summary. |
| GET |
/api/projects/:id/tickets?status=todo,blocked&assignee=&q=&tag=&parent=&archived= |
The list, filtered. |
| POST |
/api/tickets/:id/claim |
Assign a ticket to the caller and start it. |
| PUT |
/api/tickets/:id/resume |
The resume note, “Where we left off”. |
| PUT/GET |
/api/tickets/:id/summary |
The ticket’s summary, a new version per write · every version. |
| GET |
/api/tickets/:id/git |
The branches and workspaces, live from git. |
| PUT |
/api/tickets/:id/repo |
Move a ticket onto another repository of its project. |
| POST |
/api/tickets/:id/repo-request |
An agent asks the human to add a repository. |
| POST |
/api/tickets/:id/archive · /api/tickets/:id/restore · /api/projects/:id/tickets/archive |
Archive a finished ticket · put it back · archive a whole stage; the human’s. |
| POST |
/api/projects/:id/tickets/archive-request |
An agent asks the human to archive finished tickets. |
| POST |
/api/tickets/:id/tasks · PATCH/DELETE /api/tasks/:id |
The to-do list: phases and their steps, ticks and the blocked tag. |
| POST/DELETE |
/api/tickets/:id/attachments · /api/tickets/:id/attachments/:attachmentId |
Files that go with the ticket’s instructions. |
| GET/POST |
/api/projects/:id/push · /api/projects/:id/push/refresh |
Whether each ticket in work has its branch on origin · fetch, then the same. |
| GET |
/api/projects/:id/roadmap |
The Roadmap: tickets in work with their tasks, lanes and timeline. |
Posts, threads and files
| Method |
Path |
What it does |
| POST |
/api/tickets/:id/updates |
A post on the ticket’s feed. |
| POST/PUT |
/api/tickets/:id/decisions · /api/updates/:id/decision |
Ask the human to decide · the human’s answer. |
| POST |
/api/updates/:id/decision/relay |
An orchestrator records the human’s answer from the chat. |
| PATCH/DELETE |
/api/updates/:id · /api/comments/:id |
Edit or delete a post or a reply. |
| GET/POST |
/api/comments?parentType=ticket|update|review&parentId= |
A ticket’s posts, or the replies under a post or review. |
| GET |
/api/projects/:id/threads?since= · /api/projects/:id/inbox?since= |
Threads where someone spoke after you · the same, without bodies. |
| POST |
/api/uploads |
Upload a file: multipart, a local path, or base64. |
| GET |
/api/uploads/:id · /api/uploads/:id/info |
The file · its details with its local path. |
| DELETE |
/api/uploads/unattached |
Delete the unattached uploads older than a day now; the human’s. |
| GET |
/api/projects/:id/gallery?type=&from=&to=&sort=&archived=&cursor=&limit= |
The Gallery: every file on the project’s tickets. |
Workspaces, previews and runs
| Method |
Path |
What it does |
| POST |
/api/tickets/:id/workspaces · DELETE /api/workspaces/:id |
Register or remove a worktree, sub-branch or subagent sandbox. |
| PATCH/GET |
/api/workspaces/:id · /api/workspaces/:id/preview |
Set or clear the preview link · whether it answers. |
| POST/GET |
/api/workspaces/:id/preview/start · /api/workspaces/:id/preview/stop · /api/workspaces/:id/preview/restart · /api/workspaces/:id/preview/log?name=build|server |
The board’s preview of the worktree: start, stop, rebuild, its logs. |
| POST |
/api/workspaces/:id/preview/stop-link |
Stop the server behind an agent’s link; the human’s. |
| GET/POST |
/api/repos/:id/runs · PATCH/DELETE /api/runs/:id · PUT /api/repos/:id/runs/order |
A repository’s runs; agents may write them too. |
| GET |
/api/tickets/:id/runs |
Every run of every repository of the ticket, with its state. |
| POST |
/api/tickets/:id/runs/start · /api/tickets/:id/runs/stop |
Start all · stop all. |
| POST/GET |
/api/workspaces/:id/runs/:runId/start · /api/workspaces/:id/runs/:runId/stop · /api/workspaces/:id/runs/:runId/restart · /api/workspaces/:id/runs/:runId/log?name=build|server |
One run from that workspace: start, stop, restart, its logs. |
| GET |
/api/projects/:id/previews |
The project’s previews, running first. |
| POST |
/api/projects/:id/previews/stop |
Stop all; the human’s. |
PRs, reviews and cleanup
| Method |
Path |
What it does |
| GET |
/api/projects/:id/prs?refresh=1 |
The PR queue: open, and merged in the last 14 days. |
| PATCH |
/api/prs/:id |
Put a PR on hold, or release it. |
| GET |
/api/projects/:id/reviews |
Review results. |
| GET |
/api/projects/:id/reviews/results?pr=&sha=&repoId= · /api/reviews/results/:id |
Results without summaries · one in full. |
| POST |
/api/projects/:id/reviews/results |
Post a review result. |
| GET |
/api/projects/:id/cleanup?reach=0 |
What closed tickets left behind. |
| POST |
/api/projects/:id/cleanup/delete |
Delete closed tickets’ landed branches; agents: local branches only. |
Work timeline
| Method |
Path |
What it does |
| POST |
/api/projects/:id/tickets/:ticketId/events |
Record a span, wait, hand-off or heartbeat on a ticket. |
| GET |
/api/tickets/:id/events |
Every event of a ticket, and its timeline. |
| GET |
/api/projects/:id/work |
Working, waiting and blocked time over the project’s tickets. |
Summary, Daily and reports
| Method |
Path |
What it does |
| GET |
/api/summary?projectId= |
The Home and Overview summary. |
| GET |
/api/daily?date=YYYY-MM-DD&projectId= |
The day’s activity. |
| GET/PATCH |
/api/projects/:id/report-settings |
How the project’s report is made. |
| GET |
/api/projects/:id/report-settings/changes?field= · /api/report-settings/changes/:id |
Every change of the prompt or template · one. |
| POST |
/api/report-settings/changes/:id/accept · /api/report-settings/changes/:id/revert |
Keep an agent’s change · put the field back; the human’s. |
| GET/POST |
/api/projects/:id/reports?from=&to= |
The report periods with their status · post a report. |
| POST |
/api/projects/:id/reports/generate |
claude writes the period’s report. |
| GET |
/api/projects/:id/reports/:period |
Every version posted for a period. |
| GET |
/api/reports/overview?date= · /api/report-due |
Every project’s report for a period · the reports due or missing. |
| GET |
/api/projects/:id/pushed-today |
Commits and lines that reached origin today. |
MCP
| Method |
Path |
What it does |
| * |
/api/mcp |
The MCP server (streamable HTTP); see MCP tools. |